Logo
›
›vulnerability›CVE-2023-28755
Name
CVE-2023-28755
Source
NVD ( link)Debian ( link)
Description
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
CWEs
CWE-1333 CWE-1333
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/uri/releases/Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List
https://security.netapp.com/advisory/ntap-20230526-0003/Third Party Advisory
https://www.ruby-lang.org/en/downloads/releases/Release Notes
https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/Vendor Advisory
https://github.com/ruby/uri/releases/Release Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00033.htmlMailing List
https://security.netapp.com/advisory/ntap-20230526-0003/Third Party Advisory
https://www.ruby-lang.org/en/downloads/releases/Release Notes
https://www.ruby-lang.org/en/news/2022/12/25/ruby-3-2-0-released/Release Notes
https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/Vendor Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

5.3
CVSSv31
5.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
Merge URI-0.12.1
Hiroshi SHIBATA <hsbt@ruby-lang.org>
CVE-2023-28755